Junglewise Threat Intelligence

CVE-2021-44217: Ericsson CodeChecker stored XSS in comments component

CVE-2021-44217 · Severity: medium · CVSS 3.1 · Published 2022-01-21

Vendors: Ericsson, PyPI.

Executive brief

Ericsson CodeChecker, a tool used for managing and viewing code analysis results, contains a security vulnerability in its reporting interface. An attacker can inject malicious scripts into the comments section of a report. If a legitimate user views the affected report, the script could steal their login session cookies or access sensitive information from other scanning reports.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Ericsson CodeChecker versions prior to 6.18.2. The root cause is the improper neutralization of user-controllable input in the 'comments' component of the reports viewer, specifically where the UI uses the Vue.js 'v-html' attribute to dynamically render content. An attacker can exploit this by sending a crafted POST request containing malicious JSON data to the /CodeCheckerService API. When a victim views the compromised report, the injected script executes in their browser context, potentially allowing the attacker to steal session cookies (document.cookie) or perform actions on behalf of the user. The vulnerability was addressed by implementing server-side escaping for values rendered via v-html attributes.

Affected products

  • Ericsson codechecker < 6.18.2

Timeline

  • 2021-12-13: other: Pull request to fix the vulnerability submitted
  • 2022-01-04: other: Fix merged into master branch
  • 2022-01-14: patched: Version 6.18.2 released
  • 2022-01-18: advisory: NVD published CVE-2021-44217
  • 2022-01-21: disclosed: GitHub Advisory published

References

Related threats